EVTX Log Entry Finder

Tools

License Type
Free
Tool Type
Small Tool
Developer
Guidance/OpenText
Utilities - Misc
EnScripts

This script locates deleted MS Windows EVTX log records . The script works by looking for the event-log chunks that when taken with the event-log header make-up a complete EVTX log-file. The reason for not searching for individual records is that while a chunk is a self-contained entity, the records in a chunk are not—EVTX log-files use a template system in order to save space. This means that even though it's possible to find a deleted record by searching for its signature using a GREP keyword there's a good chance that what follows won't be the complete record and that some of the record's data will most likely be stored at a previous location in the associated chunk.